Let's make Let's Encrypt easy and simple

[pfg]

@cyrano

I had letsencrypt installed and, because it is not explained anywhere, also installed certbot. Nothing got replaced and it is very well possible that some or even all of my troubles are because of having both.

That's unlikely. It's the same program, the same code - it has just been renamed, and features have been added, as would have happened without a name change. All configuration files are fully compatible. You could have continued using letsencrypt-auto, and things would've kept working, or you could have switched to certbot-auto, and things would've worked just as well, without any real "upgrade" step, just another installation.

@cyrano

The same question poses itself when it comes to upgrades. Is there an upgrade mechanism? Or a security upgrade system? Ot are these entirely left to the user, to do? And how is the user to know about upgrades and sec patches?

If you're using the letsencrypt-auto or certbot-auto version of the client, the client updates itself whenever it runs. Everything taken care of. If you're using one of the packages provided by your distribution, you'll receive updates as they publish them (as with any other distribution package).

@cyrano

I mean, how old is this project? It already changed it's name by the transition to certbot and generated many clones. Very, very confusing.

In hindsight, the client development should've been separated from the server/protocol development right away, but that's easy to say now. What's important to know is that Let's Encrypt spawned a new protocol (ACME) that's intended to become an internet standard. In that context, a comparable statement would be "HTTP generated many clones and is very confusing" because there are many different HTTP servers and clients. It's true enough, but the alternative would be a proprietary API and client, giving Let's Encrypt full control over the ecosystem, which does not sound like a good path forward to me. This path might be a bit messier, but once the dust settles the advantages will be obvious.

@cyrano

And nowhere in the docs it is explained what each of these programs do. If you read the docs, you're bound to be left with the impression that it is a "client" and a "server". And you can't use a client without a server, can you?

I don't follow this paragraph. The server is what Let's Encrypt provides - the CA server, which verifies domain ownership and signs your certificate. You should not have to worry about server-related things. Which part of the documentation gave you that impression?

@cyrano

Now I hear it is not. It is a replacement, from another entity, with other documentation, which shares some of the purpose and some of the commands. But apparently, not all.

It's a drop-in replacement, configuration is compatible and command-line options are essentially the same as well.
It's really just a name change.

It's hard to discuss the shortcomings of the current documentation and possible improvements without knowing what the actual problem was in your case. Disregarding the confusion about the client being renamed, do you feel like the current certbot documentation would have been sufficient to get you set up, and if not, where is it lacking?